Privacy Policy

Effective 3 August 2026. This covers both the OrgKit web tools at orgkit.dev and the OrgKit Chrome extension.

The short version

OrgKit has no server that receives your Salesforce data, no user accounts, and no database. Everything the tools read from your org is processed in your browser and discarded when you close the tab. Files you export are generated in memory and handed to your browser's download folder. There is nothing for us to sell, share, or lose, because we never receive it.

The Chrome extension

The extension is a separate distribution of the same tools. It differs from the website in one way that matters for privacy, and it is stated plainly here.

Why it requests the cookies permission

The website authenticates through Salesforce OAuth. The extension does not: it reads the sid session cookie your browser already holds for the Salesforce org you select, and uses it to call Salesforce's own APIs on your behalf. This is why no separate login is needed and why no org-side CORS configuration is required.

Specifically:

• The cookies permission is scoped to Salesforce hosts only — *.my.salesforce.com, *.salesforce.com, *.force.com, *.cloudforce.com, *.salesforce-setup.com. It cannot read cookies for any other site.
• The session value is read at the moment of each request and attached to that request. It is never stored, never written to disk, and never transmitted anywhere except to your own Salesforce instance.
• You choose which org the extension acts on, explicitly, from a list. Nothing is inferred or auto-selected.

What the extension sends, and where

Requests go from the extension's background service worker directly to the Salesforce instance you selected, over HTTPS. They do not pass through orgkit.dev or any other server. The extension makes no network requests to any host other than the Salesforce org you chose.

Telemetry

The extension contains no analytics, no tracking, and no telemetry of any kind. It does not report usage, errors, installs, or page views. The website's privacy-friendly page-view counter is removed from the extension build at build time, and an automated check fails the build if any analytics call reappears.

What the extension stores on your device

Local browser storage only, never transmitted: your acceptance of the terms of use, and — for Automation Switch — the snapshot and audit log that make changes reversible, keyed by Salesforce Organization Id. Removing the extension removes this data. You can also clear it from the tool.

Making changes to your org

Schema Atlas is read-only. Automation Switch can enable and disable automations, and that ability is deliberately narrow:

• Only PATCH requests are permitted, and only to four Tooling API objects — Validation Rules, Flow Definitions, Apex Triggers and Workflow Rules. Any other write is refused before it leaves your browser.
• Changing anything in a production org requires typing the org's name to confirm. The header shows at all times which org you are connected to, whether it is production or a sandbox, and whether changes are currently permitted.
• Every change is recorded in a local audit log and can be reverted.

The website

orgkit.dev authenticates via Salesforce OAuth. Your password is never seen by OrgKit — login happens on salesforce.com. The resulting access token is held in browser sessionStorage for the tab's lifetime and is never sent to any OrgKit server. Full architecture detail is on the trust page.

The website uses Cloudflare Web Analytics for aggregate page-view counts. It is cookie-free, sets no identifiers, and never receives org data, metadata, tokens or Salesforce responses. The optional relay, used only if you explicitly enable it for an org that cannot add a CORS entry, forwards requests in transit and retains nothing.

What is never collected

• Salesforce usernames, passwords, or credentials of any kind
• Record data, metadata, field values, or query results from your org
• Session tokens or cookies — read in the moment, never retained
• Email addresses or contact details, unless you choose to email feedback
• Anything at all from the Chrome extension

Third parties

OrgKit does not sell, rent, or share personal information, because it does not collect any. There are no advertising networks, no data brokers, and no third-party JavaScript in the tools. The extension loads no remote code — Chrome's extension policy forbids it, and the build enforces it.

Children

OrgKit is a professional developer tool and is not directed at anyone under 16.

Changes to this policy

Material changes will be reflected here with a new effective date. Because there is no user database, there is no mailing list to notify — if you use the extension, check this page after an update.

Contact

Questions about this policy, or a privacy or security concern: himadeepguduru@gmail.com.